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Dear Ms, Krishnan: 


This is in response to your 29 March 2018 email, in which you are 
appealing the National Reconnaissance Office (NRO) 2 January 2018 response 
to items 2 and 3 of your 19 December 2017 request pursuant to the Freedom of 
Information Act {FOIA}. Items 2 and 3 were: 


2. all documents relating to administrative appeals filed from 
prepublication-review determinations, including but not limited to; 

a. administrative appeals; 

b. any correspondence or back-and-forth between an agency 
and an individual who filed an administrative appeal; and 

c. final decisions with respect to administrative appeals; 

3, all documents relating to any form of sanction imposed, or 
considered for imposition, on agency and/or former agency employees 
for failure to comply with their prepublication review obligations. 


As the NRO Appellate Authority, and after a complete review of your 
request and appeal of the no records response to items 2 and 3, l am 
upholding the NRO's initial determination that no responsive records were 
located. Prepublication Review Instruction 56-2-2, which governs the NRO 
prepublication review process, is enclosed for your Information; you will 
note that it contains no provision for administrative appeals of 
prepublication review determinations. Accordingly, no administrative appeal 
records exist. The NRO reviewers work with each submitter to find 
acceptable language where any submitter objections to prepublication review 
determinations exist. This collaboration occurs as part of the initial 
submission and continues until the issues are resolved, eliminating the need 
for an administrative appeal' process. A second thorough search of our 
records and databases was performed for any records relating to item 3- no 
records were located. ^ ' 


You are advised that you are entitled to a judicial review of this 
dete^ination in a United States District Court in accordance with 5 U S C 
§ 552, as amended* 


As part of the 2007 FOIA amendments, the Office of Government 
Information Services (OGIS) was created to offer mediation services to 




resolve disputes between FOIA (not Privacy Act) requesters and Federal 
agencies as a non-exclusive alternative to litigation. Using OGIS services 
does not affect your right to pursue litigation. You may contact OGIS in 
any of the following ways: 


Office of Government Information Services 

National Archives and Records Administration 

Room 2510 

8601 Adelphi Road 

College Park, MD 20740-6001 

E-mail: ogis®nara.gov 

Telephone: 301-837-1996 

Facsimile: 301-837-0348 

Toll-free: 1-877-684-6448 


If you have any questions or you would like to discuss your request, 
please contact the NRO FOIA Public Liaison, Patricia Cattieresi by way of the 
Requester Service Center at (703) 227-9326 and reference case number F-2018- 
00017. 


Sincerely 



Michelle Murphy 
Appellate Authority 


Enclosure: NRO Instruction 56-2-2, Prepublication Review 
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SECTION I - INTRODUCTION 


In accordance with the National Reconnaissance Office (NRO) 
Governance Plan, NRO Business Function (NBF) 50, Information 
Technology, Information Assurance, and Information Management (IT-IA- 
IM) and NRO Directive 56-2, this NRO Instruction (NI) sets forth the 
procedural implementation guidance and provides applicable information 
to perform the Prepublication Review process. All NRO personnel who 
perform tasks or have duties specific to Prepublication Review will 
comply with this NI. When the work to be performed under an NRO 
contract must comply with this NI, the program office shall list this 
NI as a reference document in the contract statement of work. 

SECTION II - NBF 50 PREPUBLICATION REVIEW SUB-PROCESS DOCUMENTATION 

The sub-sections that follow detail the Prepublication Review 
processing sub-process. 

Governing NBF 

NBF 50, IT-IA-IM 

Description 

The Chief Information Officer (CIO) administers the process 
for approval for public release of any unclassified information 
(including hard copy, electronic, or verbal) about, or affecting the 
plans, policies, programs, or operations of the NRO, the Intelligence 
Community (IC), or the United States Government. This NI provides 
guidance on when a prepublication review is required and explains the 
steps that all individuals and components involved in the process must 
complete. This NI does not apply to the public release of NRO logos 
or memorabilia. The Office of Security and Counterintelligence 
(OSSCI) administers a separate process for review and release of logos 
and memorabilia. 

Instruction Point of Contact 


Chief, Information Access and Review Team, Information 
Management Services Office (IMSO), CIO, Secure 
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Support Systems 


IMSO Website - contains additional information in support 
of the Prepublication Review process, 

Prepublication Review Submission System - Enterprise 
database used by submitters with NRO Management Information System 
access to request Prepublication Review of unclassified information 
proposed for public release. 

Tracking Information and Enterprise Response (TIER) “ 
Enterprise action tracker used to administer Prepublication Review 
cases, to include dissemination of information for review, receipt of 
4 
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review responses, and case tracking/record-keeping; and used by 
component for subtasking within components. 

Process narrative 


Unclassified materials proposed for public release must 
have the approval of a Program Security Officer (PSO) and the 
component supervisory chain prior to sending any materials to the CIO, 
If NRO contract information or information derived from an NRO 
contract is included in the material submitted for prepublication 
review, approval must also be obtained from the Contracting Officer 
{CO). The CIO will not begin the Prepublication Review process 
without the required originating component approvals. 

A minimum of 20 working days is required for the 
Prepublication Review process. Submissions that require consultation 
with external agencies will require additional time. In the event 
that the CIO is not allowed sufficient time to complete the review 
process, the CIO will issue a nonconcur determination until such time 
as the review process can be cor^leted, 

1.0 Submitter prepares document for public release 
and collects necessary approvals. 

1.1 The PSO reviews for classified or 
unclassified sensitive information relating to the submitting office's 
programs and operations; ensures that the proposed use is a public 
release; and assists the submitter in resolution of any issues 
identified in the PSO review. 


^'2 The submitter's supervisor and Program 
Manager {may be the same individual) certify that they are aware of 
the proposed public release and approve the submission to the CIO for 
further processing. This step is not required for resumes. 

1.3 If the materials proposed for public 
release are related to an NRO contract, the cognizant CO reviews the 
submission and certifies that the release does not violate the NRO 

Acquisition Manual terms regarding public release of contract-related 
information. 


2.0 Author submits the final draft of the 
unclassified materials proposed for public release along with your 
component approvals to the CIO to begin the prepublication review 
process a full 20 working days before the due date. 

3.0 Materials must be resubmitted for review if anv 
c anges are made to the drafts after submission other than editorial, 
grammatical^ or those recommended by CIO. 

4.0 Contact the CIO immediately if unusual 
circumstances prevent drafts from being submitted in time to meet 
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submission deadlines, CIO will not expedite non-official 
publications. 


5,0 0pon receipt of the unclassified materials for 
Prepublication Review and the required coinponent approvals, the CIO 
will analyze the submission and task the appropriate directorates 
and/or offices to review the materials. OSSCI/Policy, Office of 
Strategic Communicati ons ^Public Affairs), and A dvanced Systems & 


Technology Directorate 


submissions other than resumes. 


will review all 

(b)(3) 10 use424 


5.1 Components tasked with review will 
administer the review process within the individual components, 
utilizing cognizant PSOs and/or subject matter experts. The review 
process is determined by the individual components. 

5.2 Components compile and consolidate 
component-internal review findings into a single component-level 
response to the CIO and respond to the TIER action on behalf of the 
reviewing component. The component TIER response must include a clear 
statement of concurrence, nonconcurrence, or concurrence with comment. 
In the event of a nonconcurrence, the component response must include 
a clear explanation as to the reasons for the nonconcurrence and, if 
possible, a recommendation for change that would be acceptable. 

6.0 Upon completion of NRO component reviews, the CIO 
will make a determination regarding the necessity for review by other 
agencies. 


6.1 For official NRO releases, the CIO will 
consult with other agencies as appropriate as part of this process. 
Additional time is needed for external consultation. If external 
consultation is required for an official NRO release, the CIO will not 
issue a final release determination until consultation responses are 
received in the CIO. 

6.2 For non-NRO releases, the CIO does not 
administer external consultations as part of this process, but will 
advise the submitter in this regard as part of the final review 
determination response. 

7,0 After ail component and external reviews are 
complete, the CIO will respond to the submitter with a release 
determination, to include guidance on the conditions under which the 
materials may be released to the public, a detailed accounting of any 
revisions that must be made before public release, or approval for the 
release of the materials as submitted. 

8.0 The submitting office has sole responsibility for 
maintaining a copy of the approval to release the information. It 
should be kept with the submission and maintained in accordance with 
the NRO Record Control Schedule. 
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Process Flow Diagram 
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Table 1; Risk s Internal Control Table 


Risk 

Internal Control 

Inadvertent release of Information 

not appropriate for the public. 

All unclassified materials proposed 
for release to the public must be 
submitted to the PSO and component 
supervisory chain for approval prior 
to materials being sent to CIO, 


CIO tasks appropriate Directorates 
and Offices to review the materials 


CIO determines if Department of 

Defense or the IC needs to review the 
material prior to release. 


Documented agreement with IC 
counterparts to assist in reviewing 
equities, 


Table la UNCLASSIFIED 


SECTION III - CONFIGURATION CONTROL 

All changes to the Prepublication Review Instruction 

require NBF owner approval. 

APPROVING SIGNATURE 


As the NBF owner for IT-IA-IM, I confirm that this document 
provides a complete representation of the Prepublication Review 
Instruction, and that the document has been coordinated with 
stakeholders of the process. 


Jijia T. singer ^ 

IT-IA-IM NBF Owner 


“2013 

Date 
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APPENDIX B - GLOSSARY 


Agiency 

Any executive or military department, other 
establishment, or entity included in the definition of 
agency in 5 U.S-C, § 522(f)- 

Business 

Information 

Technology 

Information Technology (IT) activities associated with 
the development and maintenance of software and 
hardware to support business functions to include, but 
not limited to, human capital, core financials, 
acquisition, procurement, logistics, grants, asset 
management, payroll, budget formulation and eKecution, 
performance management, travel, time and attendance, 
cost accounting, project accounting, earned value 
management, personnel management applications, and 
elements of security systems that track personnel. 


Business Information Technology (BIT) also includes 
all supporting feeder systems that support the 

Business Management operations of an organization or 
agency. BIT applications and services shall be 
available to business systems users via Enterprise 
Information Technology (EIT) networks and 
workstations, 

Coo^onent 

Any individual NRO D or 0 that participates in the 
Prepublication Review process. 

Enterprise 

Information 

Technology 

Encompasses Information Technology (IT) activities 
associated with the Agency's infrastructure, such as 
desktops, local area networks, wide area networks, 
processors, software, security, operations, help 
desks, applications, support services, and resources 
associated with the IT, This category identifies IT 
elements and applications available to all users of 
the enterprise (e.g., e-mail), Information assurance 
(lA) capabilities are to be included in this 
category. Also included in the Enterprise Information 
Technology (EIT) category are completely installed 
computer systems and their peripheral components. 
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Information 

Technology 

Any equipment or interconnected system or subsystem of 

equipment, that is used in the automatic acquisition, 
storage, manipulation, management, movement, control, 
display, switching, interchange, transmission, or 
reception of data or information. Equipment is used 
directly or is used by a contractor under a contract 
which requires the use of such equipment, or requires 
the use, to a significant extent, of such equipment in 
the performance of a service or the furnishing of a 
product. Information Technology (IT) includes 
computers, ancillary equipment, software, firmware and 
similar procedures, services (including support 
services), and related resources. It is further 
delineated by Business Information Technology (BIT), 
Enterprise information Technology (EIT), and Mission 
Information Technology (MIT), 

Mission 

Information 

Technology 

Information Technology (IT) activities associated with 
collection, analysis, and production systems, and 
information sharing/collaboration tools, applications, 
and software, with the exception of office autojuation 
systems- 

These systems can exist at the point where information 
is initially processed or at the point where analysts 
turn collected information into intelligence and 
knowledge- Mission Information Technology {MIT) also 
includes special purpose software and IT elements used 
among small, unique user populations* 

Non-NRO 

Release 

A record or documsnt that will b© released not on the 
behalf of the NRO (for example, private party 
documents, contractor produced documents not produced 
for the NRO). 

Official 

Release 

A record or document that will be released by the NRO 

or an NRO component as part of its mission and 
function 

Prepublication 

Review 

The process established to control and monitor the 
release of unclassified information about, or 
affecting the plans, policies, programs, or operations 
of the NRO, the Intelligence Community or U.S. 
Government, 

Stabmitter 

The individual who created the document at issue 

Working Days 

Days when the NRO rs operating (specifically excludes 
Saturdays, Sundays, and legal public holidays) 
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APPENDIX B - ACRONYM LIST 




BIT 

Business Information Technology 

CIO 

Chief Information Officer 

CO 

Contracting Officer 

EIT 

Enterprise Information Technology 

IC 

Intelligence Community 

IMSO 

Information Management Services Office 

IT 

Information Technology 

IT-IA-IM 

Information Technology, Information Assurance, 
Information Management 

MIT 

Mission Information Technology 

NBF 

NRO Business Function 

NI 

NRO Instruction “ 

NRO 

National Reconnaissance Office 

OS&CI 

Office of Security and Counter-Intelligence 

PSD 

Program Security Officer 

TIER 

Tracking Information and Enterprise Response 
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APPENDIX C -- REFERENGES/AUraORITIES 


a- 50 United States Code, Chapter 15, National Security Act of 

1947 


b. Executive Order 12333, United States Intelligence Activities, 
as amended 


c. Executive Order 13526, Classified National Security 
Information, 29 Dec 09 

di Department of Defense Instruction 5230.29, Security and 
Policy Review of Department of Defense Information for Public Release, 
8 Jan 09 


e. Department of Defense Regulation 5230.9, Clearance of 
Information for Public Release, 9 Apr 96 50 LJSC 3507 


f. Agency Regulation 


Agency Prepublication Review of 


Certain Material Prepared for Public Dissemination, 30 May 07 


g. Agency Regulation 


Policy and Procedures for the Release 


of Unclassified Agency Official Information to the Public, 19 Sep 95 
h. National Reconnaissance Office Acquisition Manual 


i. ^ National Reconnaissance Office Business Function 50, 
Information Technology, Information Assurance, and Information 
Management 


j. National Reconnaissance Office Directive 56-2, Access and 
Release 
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